CVE-2026-20935

MEDIUM

Windows VBS Enclave - Info Disclosure

Title source: llm

Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an unauthorized attacker to disclose information locally.

CVSS v3 6.2

EPSS 0.0003

EPSS Percentile 9.0%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-822

Status published

microsoft/windows_11_23h2 < 10.0.22631.6491

microsoft/windows_11_24h2 < 10.0.26100.7623

microsoft/windows_11_25h2 < 10.0.26200.7623

Published Jan 13, 2026

Tracked Since Feb 18, 2026